Restricting NTP Access on a Router

[jws1986]

I have an internet facing Cisco 891F router that I have been requested to make some NTP changes on. The current and only NTP configuration has the router looking to 3 different public time servers.

ntp server 1.1.1.1

ntp server 2.2.2.2

ntp server 3.3.3.3

When querying that routers IP address with an NTP tool it responds as server, which we do not want. I don't want to prevent this router from getting ntp from the public servers. I just want to prevent any client on the internet from querying this router for NTP.  I don't have much experience with ACLs and the terminology for query-only, serve, peer, and serve-only have been a bit confusing for me.

Am I headed in the right direction with this?

access-list 46 remark utility ACL to block everything
access-list 46 deny any
!
access-list 47 remark NTP peers/servers we sync to/with
access-list 47 permit 1.1.1.1
access-list 47 permit 2.2.2.2

access-list 47 permit 3.3.3.3
access-list 47 deny any
!
! NTP access control
ntp access-group query-only 46 ! deny all NTP control queries
ntp access-group serve 46 ! deny all NTP time and control by default
ntp access-group peer 47 ! permit sync to configured peer(s)/server(s)
ntp access-group serve-only 46 ! deny NTP time sync requests

[jws1986]

Anyone? 

[paul driver]

Hello

You just want you router to be able to accept ntp update from those servers

access-list 10 permit 1.1.1.1
access-list 10 permit 2.2.2.2
access-list 10 permit 3.3.3.3
ntp server 1.1.1.1
ntp server 2.2.2.2
ntp server 3.3.3.3
ntp access-group peer 10

[jws1986]

Yes I do want that. But I also want to prevent any internet source from accessing this router as an NTP server. 

[paul driver]

Hello

---

@jws1986 wrote:

Yes I do want that. But I also want to prevent any internet source from accessing this router as an NTP server. 

---

Well try and test that config i posted - it should just allow communication betwen those ntp servers and your rtr

[JustoSocarras27727]

Thank you Paul!!, it worked for me.

[paul driver]

Hello

Gald to hear - Can you please maked as solve as to assist others in the future.